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I. Real Party in Interest 

GEMPLUS is the real party in interest, and is the assignee of Application No. 
09/831,745. 

II. Related Appeals and Interferences 

There are no known appeals, interferences or judicial proceedings which will 
affect, or be directly affected by, or have bearing on the Board's decision in the 
pending appeal. 

III. Status of Claims 

The application contains claims 1-38. Claims 2 and 14 have been canceled. 
Claims 24-35 have been allowed, and claim 9 has been identified as containing 
allowable subject matter but is objected to as depending from a rejected claim. 
Claims 1 , 3-8, 10-13, 15-23 and 36-38 stand finally rejected. This appeal is directed 
to all finally rejected claims. 

IV. Status of Amendments 

No amendments were heretofore filed subsequent to the final Office Action. 
This Brief is accompanied by an Amendment to correct an informality in claim 16 that 
was identified in the final Office Action. That amendment is reflected in the claims 
set forth in the Claims Appendix. 
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V. Summary of Claimed Subject Matter 

The claimed subject matter is directed to the control of the life cycle of a 
portable electronic object, such as a smart card. As illustrated in the example of 
Figure 6a, during its life cycle the electronic object goes through a number of states, 
E1-E4 (pages 16-18 of the specification). The claimed subject matter is particularly 
concerned with avoiding problems of fraudulent initialization, or inadvertent error, as 
the life cycle transitions from one state to the next. 

Referring to Figure 1 , to address these concerns the object, e.g. smart card, 
contains a check engine 9 and a plurality of tables 1 1-13 that are employed to 
determine whether a transition from one state to another is permitted, and if so to 
carry out certain actions associated with that particular transition. The tables are 
illustrated in more detail in the example depicted in Figures 6a to 6d. The table of 
transitions 1 1 , depicted in Figure 6b, indicates whether the transition from the current 
state to another state is permitted. The check table 12 of Figure 6c indicates the 
particular checks that are to be performed for a transition from one specific state to 
another. The table of actions 13, depicted in Figure 6d, indicates the actions to be 
performed during a given state transition. An example of the checks and actions 
associated with these tables is described on pages 18-21 of the specification. 

The appealed claims include four independent claims, namely claims 1,10, 
1 1 and 12. Claim 1 recites a device for controlling the life cycle of a portable 
electronic object, in which the life cycle is determined by a succession of state 
transitions, where the states determine the services offered by the object. The 
object comprises a processing unit (Fig. 1 , processing unit 2), a volatile memory (Fig. 
1, RAM 3), program memories (Fig. 1, ROM 4) and data memories (Fig. 1, EEPROM 



•1 1 

Appeal Brief 
Application No. 09/831,745 
Attorney's Docket No. 1032326-000139 

Page 4 

5). Each of the memories has a content defining a plurality of configurations (page 
6, lines 22-24; page 17, line 15 to page 18, line 12). The life cycle control device 
comprises means for controlling the transition from a first state to a second state of 
the portable electronic object. In the disclosure, this means is generally embodied in 
the check engine 9, in combination with the tables 11,12 and 13. 

Claim 1 recites that the controlling means includes means for selectively 
enabling and/or inhibiting state transitions. This means comprises the check engine 
9 in combination with the table 1 1 (page 11, lines 1-15). The control means also 
includes means for checking the content of the volatile memory, the data memories 
and the program memories of the portable electronic object as a function of the state 
transition to be effected (page 7, lines 3-6). This means comprises the check engine 
9 in combination with the table 12 (page 9, lines 21-24). This checking means 
ensures that only some transitions are permitted amongst all the transitions between 
any two possible states of the portable electronic object. (Figure 5a; page 13, line 28 
to page 15, line 6). 

Claim 10 recites a portable electronic object having a processing unit (Fig. 1, 
processing unit 2), a volatile memory (Fig. 1, RAM 3), program memories (Fig. 1, 
ROM 4), data memories (Fig. 1 , EEPROM 5), and a device for controlling the life 
cycle of the object (check engine 9 in combination with tables 11-13). This device 
comprises means for controlling the transition from a first state to a second state of 
the portable electronic object, including means for selectively enabling and/or 
inhibiting state transitions (check engine 9 in combination with table 1 1 ; page 1 1 , 
lines 1-15). The device also includes means for checking the content of the volatile 
memory, the data memories and the program memories of the portable electronic 
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object as a function of the state transition to be effected (check engine 9 in 
combination with table 12; page 9, lines 21-24), so that only some transitions are 
permitted amongst all the transitions between any two possible states of the portable 
electronic object. (Fig. 5a; page 13, line 28, to page 15, line 6). 

Claim 11 recites a smart card having a processing unit (Fig. 1, processing unit 
2), a volatile memory (Fig. 1, RAM 3), program memories (Fig. 1, ROM 4), data 
memories (Fig. 1, EEPROM 5), and a device for controlling the life cycle of the 
object. This device comprises means for controlling the transition from a first state to 
a second state of the smart card (check engine 9 in combination with tables 11-13), 
including means for selectively enabling and/or inhibiting state transitions (check 
engine 9 in combination with table 1 1 ; page 1 1 , lines 1 -1 5). The device further 
includes means for checking the content of the volatile memory, the data memories 
and the program memories of the smart card as a function of the state transition to 
be effected (check engine 9 in combination with table 12; page 9, lines 21-24), so 
that only some transitions are permitted amongst all the transitions between two 
possible states of the smart card (Fig. 5a; page 13, line 28, to page 15, line 6). 

Claim 12 recites a method of controlling the life cycle of a portable electronic 
object, the life cycle being determined by a succession of state transitions, with the 
states determining the services offered by the object (page 2, line 10, to page 3, line 
2). The object comprises a processing unit (Fig. 1 , processing unit 2), a volatile 
memory (Fig. 1, RAM 3), program memories (Fig. 1, ROM 4) and data memories 
(Fig. 1, EEPROM 5). Each of the memories has a content defining a plurality of 
configurations (page 6, lines 22-24). The method is implemented within the object, 
following a request to transition from a current state to a new state. A first step 
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comprises validation of the enabling of the request (Fig. 5a, step 51) using means for 
enabling and/or inhibiting state transitions (check engine 9 and table 1 1 ), so that only 
certain transitions are permitted amongst all the transitions between any two 
possible states of the object (page 14, lines 6-14). The second step comprises 
evaluating checks on the configuration of the object that are associated with a 
permitted transition (Fig. 5a, step 52; page 14, lines 14-19). The final step 
comprises changing to the new state of the object if the requested transition is 
enabled and if the checks on the configuration of the object are satisfied (Fig. 5a, 
steps 54 and 56; page 14, line 30 to page 15, line 5). 

VI. Grounds of Rejection to be Reviewed on Appeal 

The final Office Action presents four grounds of rejection: 

1. Claims 1, 7, 10-17 and 36 stand finally rejected under 35 U.S.C. §102, as 
allegedly being anticipated by the Chan et al. patent (U.S. 6,005,942); 

2. Claims 3 and 18 are finally rejected under 35 U.S.C. §103 on the basis of 
the Chan patent in view of the Wagner patent (U.S. 5,301 ,100); 

3. Claims 4-6, 8 and 19-23 are rejected under 35 U.S.C. §103 on the basis of 
the Chan and Wagner patents in further view of the Silberschatz et al. publication; 
and 

4. Claims 37 and 38 are rejected under 35 U.S.C. §103 on the basis of the 
Chan patent in view of the Grimonprez patent (U.S. 5,473,690). 

Appellants request a review of the first and third grounds of rejection. 
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VII. Argument 

A. Rejection of Claims 1, 7, 10-17 and 36 under 35 U.S.C. §102 
1. Claims 1. 10 and 11 

Claim 1 recites a device for controlling the life cycle of a portable electronic 
object that includes, among other elements, a volatile memory, program memories 
and data memories. These three different memories are respectively identified in 
Figure 1 as elements 3, 4 and 5. Claim 1 recites that the device comprises a means 
for controlling the transition from a first state to a second state of the portable object. 
This device includes, among other elements, "means for checking the content of the 
volatile memory, the data memories and the program memories of the portable 
electronic object as a function of the state transition to be effected." One example of 
this means, therefore, is the check engine 9 in conjunction with the check table 12 
and the check programs 67, 68 referenced by that table. 

In the Amendment filed January 6, 2006, Applicants pointed out that the Chan 

patent does not disclose this claimed subject matter. In response to this argument, 

the final Office Action states: 

Chan explicitly discloses a feature df the installation of an application into 
the IC card which meets the limitation iri contention: an installed state of 
an application is achieved when an applet allocates the necessary space 
and data structure for the operation. (Col. 13: 7-9) 

Thus, it appears that the Office Action is taking the position that, the mere act of 
installing an applet on a smart card, in which space is allocated within memory for 
the applet, meets the claimed subject matter. 

As set forth in MPEP §2131 , "to anticipate a claim, the reference must teach 
every element of the claim" (emphasis added). The Chan patent does not meet this 
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requirement. Claim 1 recites that the device for controlling the life cycle of the 
portable electronic object includes a means for checking the content of each of three 
different memories, namely the volatile memory, the data memories and the program 
memories of that object. The Chan patent's disclosure of installing an application at 
column 13, lines 7-9, including the allocation of necessary space in memory, does 
not teach the claimed subject matter. At best, it only teaches that space is allocated 
in the particular memory in which the applet is installed, e.g. the program memory. 
There is no disclosure that, during the installation process, the other memories, i.e. 
the volatile memory and the data memories, are also checked. Furthermore, there is 
no disclosure that the content of these memories are checked "as a function of the 
state transition to be effected." 

In accordance with the teaching of the present application, by checking the 
content of these memories as a function of the particular state transition to be 
effected, fraudulent initialization and/or inadvertent error can be minimized. The 
Chan patent does not disclose that, during the installation of an applet op a card, 
these types of checks are carried out to accomplish these results, or any other 
results. 

For at least this reason, therefore, the Chan patent fails to meet the 
requirement for a rejection based upon anticipation. The final Office Action has not 
shown that the Chan patent discloses all of the subject matter recited in the claim. 

For the same reasons, claims 10 and 1 1 are also not anticipated. These two 
claims recite a portable electronic object and a smart card, respectively, having 
means for checking the content of the volatile memory, the data memories and the 
program memories as a function of the state transition to be effected. As discussed 
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in connection with claim 1 , the Office Action does not identify such subject matter in 
the Chan patent. 

2. Claim 12 

Claim 12 recites a method of controlling the life cycle of a portable electronic 
object having a volatile memory, program memories and data memories. These 
memories have a content that defines a plurality of configurations. Claim 12 recites 
a method that is implemented "within the object". This method includes, among 
other steps, that of evaluating checks on the configuration of the object that are 
associated with a permitted transition. The final step is changing to the new state of 
the object if two conditions are met, i.e. the requested transition is enabled and the 
checks on the configuration of the object are satisfied. 

In rejecting this subject matter, the final Office Action refers to the Chan 
patent at Figures 7a and 7b, as well as column 12, lines 43-67, column 16, lines 16- 
29, and column 17, lines 15-45, with the explanation "card domain validates and 
modifies the current state." 

None of the referenced portions of the Chan patent disclose the step of 
evaluating checks on the configuration of the smart card, particularly checks that are 
associated with a permitted transition. Rather, the cited passages in the reference 
are primarily concerned with the mechanism for loading an application on the card. 
They do not disclose that the configuration of the card, as defined by the content of 
its memories, is checked as part of the loading process. 

Again, therefore, for reasons similar to those presented previously, the Office 
Action does not meet the requirements for a rejection based upon anticipation. 
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While the Chan patent is directed to the same general subject matter as the pending 
claims, namely the life cycle of a portable electronic object such as a smart card, the 
claims are not broadly directed to that concept alone. Rather, they recite specific 
features that provide control over fraudulent initialization or inadvertent error that can 
occur in the transition between the states of the life cycle. The Office Action has not 
shown that the specific features recited in the claims, as identified above, are taught 
by the Chan patent. 

B. Rejection of Claims 4-6. 8 and 19-23 under 35 U.S.C. S 103 
1. Claims 4-6, 8 and 20 

The rejection of claims 4-6 and 8 acknowledges that neither of the Chan nor 
Wagner patents suggests a table for checks and a table for actions. However, the 
final Office Action goes on to characterize the claimed subject matter as "a trivial 
permutation based on a standard entity-relationship data model", with reference to 
the Silberschatz publication at pages 23-28, sections 2.1 .1 - 2.1 .2. The Office 
Action fails to identify any relationship between the downloading of applications onto 
a smart card, as disclosed in the Chan patent, and objectives of the Silberschatz 
publication. 

More particularly, as its title indicates, the Silberschatz publication is directed 
to database systems. The opening paragraph on page 23 states that the entity- 
relationship data model pertains to "database design". The concepts employed in 
the design of databases has no apparent applicability to the loading of applications 
onto smart cards. Nor does the final Office Action offer any explanation why a 
person of ordinary sill in the art would be motivated to look to the Silberschatz 
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publication when confronted with the problem of how to securely load applications 
onto a smart card. 

As set forth in MPEP §2143, there are three criteria that must be met to 
establish a prima facie case of obviousness. The first of these is that "there must be 
some suggestion or motivation, either in the references themselves or in the 
knowledge generally available to one of ordinary skill in the art, to modify the 
reference or to combine reference teachings." The final Office Action does not 
identify any source of such a suggestion. It certainly is not found in the references 
themselves. The Chan patent does not give any hint that database design concepts 
can be employed for loading applications onto smart cards. Nor does the 
Silberschatz patent suggest any nexus between these two disparate objectives. 
Furthermore, the final Office Action does not cite any other evidence of knowledge in 
the art that would provide the necessary suggestion or motivation. 

For at least this reason, therefore, the final Office Action does not establish a 
prima facie case of obviousness. 

Another of the criteria set forth in the MPEP is that "the prior art reference (or 
references when combined) must teach or suggest all the claim limitations" 
(emphasis added). The final Office Action does not even attempt to meet this 
requirement. Specifically, it acknowledges that the Chan and Wagner patents do not 
disclose an element recited in claim 4, namely "a table of the checks to be made per 
permitted state transition." And yet it fails to identify where this claimed feature is 
taught in the Silberschatz publication. The reason for that is simple; the Silberschatz 
publication does not contain any such teaching. It is directed to database design, 
and as such is not concerned with performing checks during transitions of a portable 
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electronic object from one state to another. While relational databases may contain 
tables, per se, there is no disclosure of the particular type of check table recited in 
claim 4, particularly one that is used by a check engine as also recited in the claim. 

For similar reasons, the subject matter of claim 20, which also recites a table 
of checks, is not taught by the references. 

Claims 5, 6 and 8 recite extensions to the various tables. Again, the final 
Office Action does not even attempt to show where these claimed features are 
taught by the references. Rather, it simply dismisses them as "desirable features." 
Outside of Appellants' own disclosure, where is there any teaching of such 
desirability, let alone a disclosure of how to actually implement such features? 

For this additional reason, therefore, the final Office Action fails to meet the 
criteria necessary to support a rejection under 35 U.S.C. § 103, since it has not 
shown that all of the claim limitations are taught or suggested by the prior art 
references. 

C. Conclusion 

The rejections of the claims are based upon generalities, and do not show 
that all of the claim limitations are anticipated by the Chan patent, or otherwise 
taught by the references. Furthermore, there is no evidence in the record of a 
suggestion or motivation to apply the database design principles of the Silberschatz 
publication to the field of endeavor of the Chan patent. 

The rejections of the claims are not properly founded in the statute, and 
should be reversed. 
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VIM. Claims Appendix 

See attached Claims Appendix for a copy of the claims involved in the appeal. 
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CLAIMS APPENDIX 



The Appealed Claims 

1 . A device for controlling the life cycle of a portable electronic object, the 
life cycle being determined by a succession of state transitions, said states 
determining the services offered by the object, said object comprising a processing 
unit, a volatile memory, program memories and data memories, each of said 
memories having a content defining a plurality of configurations, wherein said device 
comprises means for controlling the transition from a first state to a second state of 
the portable electronic object, including means for selectively enabling and/or 
inhibiting state transitions, and means for checking the content of the volatile 
memory, the data memories and the program memories of the portable electronic 
object as a function of the state transition to be effected, so that only some 
transitions are permitted amongst all the transitions between any two possible states 
of the portable electronic object. 

3. A device according to claim 1 , wherein the control means enable 
and/or inhibit a state transition, using a table of permitted state transitions. 

4. A device according to Claim 3, wherein the control means comprise: 

- in addition to the table of permitted state transitions; 

- a table of the checks to be made per permitted state transition; 

- and a check engine using said tables. 

5. A device according to Claim 3, wherein the means for controlling the 
transition from a first state to a second state of the portable electronic object 
comprise: 

- an extension to the table of permitted state transitions. 

6. A device according to Claim 4, wherein the means for controlling the 
transition from a first state to a second state of the portable electronic object 
comprise: 

- an extension to the table of permitted state transitions; 

- an extension to the table of checks to be made per permitted state transition; 

Claims Appendix - 1 



and wherein the check engine uses said table extensions. 

7. A device according to claim 1 , wherein the control means comprise 
means for triggering actions during the processing of a request for transition 
crossover from a first state to a second state of the portable electronic object. 

8. A device according to Claim 7 wherein said controlling means includes: 

- an extension to the table of permitted state transitions; 

- an extension to the table of checks to be made per permitted state transition; 
and wherein the check engine uses said table extensions; and 

wherein said means for triggering actions during the processing of a request 
for transition crossover from a first state to a second state of the portable electronic 
object comprise a table of actions which can be used by the check engine. 

10. A portable electronic object having a processing unit, a volatile 
memory, program memories, data memories, and a device for controlling the life 
cycle of the object comprising means for controlling the transition from a first state to 
a second state of the portable electronic object, including means for selectively 
enabling and/or inhibiting state transitions, and means for checking the content of the 
volatile memory, the data memories and the program memories of the portable 
electronic object as a function of the state transition to be effected, so that only some 
transitions are permitted amongst all the transitions between any two possible states 
of the portable electronic object. 

11. A smart card having a processing unit, a volatile memory, program 
memories, data memories, and a device for controlling the life cycle of the object 
comprising means for controlling the transition from a first state to a second state of 
the smart card, including means for selectively enabling and/or inhibiting state 
transitions, and means for checking the content of the volatile memory, the data 
memories and the program memories of the smart card as a function of the state 
transition to be effected, so that only some transitions are permitted amongst all the 
transitions between two possible states of the smart card. 
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12. A method of controlling the life cycle of a portable electronic object, the 
life cycle being determined by a succession of state transitions, said states 
determining the services offered by the object, said object comprising a processing 
unit, a volatile memory, program memories and data memories, each of said 
memories having a content defining a plurality of configurations, said method being 
implemented, within the object, following a request _to transition from a current state 
to a new state, according to the following steps: 

- a step of validation of the enabling of said request using means for enabling 
and/or inhibiting state transitions, so that only certain transitions are permitted 
amongst all the transitions between any two possible states of the object; 

- a step of evaluating checks on the configuration of the object that are 
associated with a permitted transition; and 

- a step of changing to the new state of the object if the requested transition is 
enabled and if said checks on the configuration of the object are satisfied. 

13. A method according to Claim 12, further comprising a step of executing 
systematic actions associated with the requested transition. 

15. A method according to Claim 12, further comprising a step of executing 
positive actions performed if the requested transition is permitted and if the checks 
associated with the requested transition are satisfied. 

16. A method according to claim 12, further including a step of executing 
negative actions if the checks associated with the requested transition are not 
satisfied. 

17. A method according to claim 12, further including a step of executing 
positive actions if the requested transition is permitted. 

18. A method according to claim 12, implemented within the object, 
following a request for transition, wherein the step of validating the enabling of the 
said request comprises analysing a table of permitted transitions. 
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19. A method according to Claim 18, including the steps of: 

- using an entry, corresponding to the requested transition, in a table of 
actions, and 

- executing a program of actions defined by said entry. 

20. A method according to claim 18, further including the step of evaluating 
the checks associated with the requested transition comprising the steps of: 

- using an entry in a table of checks, and 

- executing a program of checks defined by said entry. 

21 . A method according to claim 18 further including the step of executing 
positive actions, if the requested transition is enabled and if the checks associated 
with the requested transition are satisfied, comprising the steps of: 

- using an entry, corresponding to the requested transition, in a table of 
actions, and 

- executing a program of actions defined by said entry. 

22. A method according to claim 18 further including the step of executing 
negative actions if the checks associated with the requested transition are not 
satisfied, comprising the steps of: 

- using an entry, corresponding to the requested transition, in the table of 
actions, and 

- executing a program of actions defined by said entry. 

23. A method according to claim 18, further including the step of executing 
positive actions if the requested transition is enabled, comprising the steps of: 

- using an entry, corresponding to the requested transition, in the table of 
actions, and 

- executing program of actions defined by said entry. 

36. A method according to claim 12, wherein said method does not enable 
the crossover of a state transition, from an additive state to a reference state. 
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37. The method according to claim 1, wherein said checking means 
determines whether said memories contain data that is invalid for the transition to be 
effected. 

38. The method according to claim 12, wherein said evaluation step 
comprises checking whether said memories have a predetermined configuration 
associated with the transition from said current state to said new state. 
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